7

Revert All GPO settings to Undefined (Not reverse what they are now)

I inadvertently applied GPOs to an entire OU which was not ready to be deployed yet. I have unlinked the GPOs but of course they have already been applied. Is there a way to undo these changes (not reverse the setting but make it "clean" aka, "undefined"?

Similar to This answer but I'm looking for a way to make the server look & behave as if these settings were never applied. Surely I'm not the first SA to oops like this. Or even have a machine that needs them unapplied for whatever other reason.

*Note: I have seen this answer else where but I've never heard anything like this before (actually it contradicts everything I've heard) but I'm hopeful there may be some "trick" like it to make it work: (paraphrasing) If you have some really weird gp issues...you can delete the security file which is located in windows\security which will force the machine back to the stage where it joined a domain. Then run "gpupdate /force /boot"

0

1 Answer 1

8

No, you can't turn back time on this one.

The previous state of the computers from before the GPO was applied was not recorded, so when Group Policy changed the state of those configurations, there is now no recorded previous state to revert back to. If the damage is seriously bad, you'd be looking at restoring the affected computers from a backup after removing the offending GPOs.

Sure, most policies are resistant against "tattooing," as described here, but not all of them. There are certain policy settings that can simply be deleted once the GPO has been removed or the computer/user is no longer in scope of the GPO, but some settings are not that simple.

In other words, imagine that before the GPO, a particular registry entry was set to 1 and was not affected by Group Policy. Then your Group Policy was applied and set that registry entry to 0. Now you say "oh no, put it back like how it was!" so you go and put that GPO setting to Not Defined. But the damage is already done. Not Defined does not mean "set it back to 1 if it was 0, or set it back to 0 if it was 1." It simply means that Group Policy will no longer flip that switch one way or the other.

No, of course you are not the first sysadmin to make this mistake. But Microsoft has already given tools to help you protect you from yourself. (E.g., Advanced Group Policy Management with check-out/check-in, offline editing and approver features, etc.)

I know you don't want to be lectured... you just need to be more careful.

1
  • Well I was afraid this would be the answer, but I was hoping against hope that MS or a 3rd party found a way to do this. The tools to protect myself were n/a b/c I was turning them on, just to an adjacent OU. oh well, the lessons learned the hard way are the ones remembered most
    – Ben-Jamin
    Dec 12, 2013 at 23:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .